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Abstract — We analyze the asymptotic key rate of the single 
photon B92 protocol by using Renner's security analysis given in 
2005. The new analysis shows that the B92 protocol can securely 
generate key at 6.5% depolarizing rate, while the previous 
analyses cannot guarantee the secure key generation at 4.2% 
depolarizing rate. 

I. Introduction 

The B92 quantum-key-distribution (QKD) protocol has 
remained less popular than the famous BB84 protocol 0], 
while both protocols provide the unconditional security. One 
plausible reason for the unpopularity is that the B92 is weaker 
to the channel noise than the BB84. Specifically, the BB84 
with the standard one-way information reconciliation can gen- 
erate secure key over the depolarizing channel at depolarizing 
rate 16.5%, while the previous security analyses of the B92 
cannot guarantee the secure key generation at depolarizing rate 
3.5% |D, 3.7% I4j or 4.2% Q. 

The conventional security analyses of the B92 |4j, Q, 
[8 1 involved many inequalities, and the tightness of those 
inequalities was not explicitly discussed. We cannot exclude 
the possibility that the B92 protocol can securely generate 
key at depolarizing rates over 4.2%. On the other hand, the 
asymptotic secure key rate in Q, ||6) is expressed as the 
minimum of conditional quantum entropy over a certain set 
of bipartite quantum states. By using the convex optimization 
technique, we can completely remove careful manipulation of 
many inequalities, which could underestimate the secure key 
rate. In this paper we reformulate the asymptotic secure key 
rate formula as a convex optimization problem, and compute 
the rate without any manipulation of inequalities directly by 
a numerical optimization procedure. As a result, we show 
that the B92 protocol [2| without noisy preprocessing [7| can 
securely generate key at 6.5% depolarizing rate. 

II. New Security Analysis of the B92 Protocol 

In this section, we present a new formula for the asymptotic 
key rate of the B92 protocol, based on Renner's security 
argument [6|. Firstly, we fix notations. Let ||0), |1)} be some 
fixed orthonormal basis of a qubit. In the B92 protocol ||2), 
Alice sends the quantum state 



kp;>=y8|0> + (-iya|l>, 



(1) 



for j = 0, 1, where /3 = Vl -a 2 , and < a < 1/ VI For 
convenience of presentation, we also define 

|^> = a|0>-(-iy J 8|l>. 

We can see that {\ifj), \<fj)} forms an orthonormal basis of a 
qubit. 



On the other hand, we can express a qubit channel as 
follows. Define the three Pauli matrices cr x , cr v , and o% as 
usual. Then a qubit density matrix p can be expressed as [5| 



P=\{l + xcr x + yo-y + zcr,) , 



where x,y, z e R and x 2 + y 2 + z 2 < 1 . The vector (x, y, z) 
is called a Bloch vector. The qubit channel Sg from Alice to 
Bob can be expressed as a map between Bloch vectors by 



(2) 
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(3) 



\0)a\<Pq)b + \1)a\<Pi)b 
V2 



As in 181, we also define the four POVM 



F 



= \<Po)(<Po\/2, 
= \<pi)(<pi\/2, 
= \<fo)(<Po\/2. 



(4) 
(5) 
(6) 
(7) 



After passing the quantum channel &b from Alice to Bob, 
|¥>0F| becomes 



p Mfl = (/®S fl )|W|. 



(8) 



In a quantum key distribution protocol, the state change Sb 
is caused by Eve's cloning of the transmitted qubits to her 
quantum memory. The content of Eve's quantum memory is 
mathematically described by the purification \<S>\.abe) of Pi^b- 
Let Pij.be = ^iabeX^iabeI 

In addition to Eve's quantum memory, she also knows the 
content of public communication over the classical public 
channel between Alice and Bob. For each transmitted qubit 
from Alice to Bob, the public communication consists of 1-bit 
information indicating whether Bob discards his received qubit 
or not. We also have to take it into account. We shall represent 
the public communication by a classical random variable P 
that becomes 1 if Bob discards his qubit and otherwise. So, 
P = when Bob's measurement outcome is Fo or F\, and 
P — 1 when Bob's measurement outcome is Fq or F\. 

On the other hand, in the B92 protocol, Bob performs the 
measurement specified by Eqs. ©-(Hi. Alice and Bob keep 



their a qubit if and only if its measurement outcome is Fq or 
F\, Otherwise it is discarded and is not used for generation 
of secret key. This is mathematically equivalent to set Alice's 
bit to if the measurement outcomes is Fq or Fj. Therefore, 
from Eve's perspective on Alice's classical bit, the joint state 
between Alice and Bob after the selection by measurement 
outcomes is equivalent to 

Piabep = {I a ® V^o ® IePiabeIa ® V^o ® h 

+h ® VfT ® IePiabeIa ® V^i ® h) ® |0)p<0| P 
+|0) A (0U ® ( V^Q ® Ie^a[p\abe\ y[F~ Q ® / £ 
+ ^®I e Tt a [p 1abe ]^®Ie)® \l)p(l\ P . 

Observe that the state change from P\ A be to Piabep is a trace- 
preserving completely positive map. 

Remark 1: Alternatively, by using the more usual approach 
to model a quantum state after selective measurement, one can 
also regard the quantum state after having Bob's measurement 
outcome Fq or F\ as 



1 



-Ah ® V^o ® IePiabeIa ® a/Fo ® h 



{Fq + Fi)Tr A [p MB ] 
+I A ® yfF\ ® IePxabeIa ® V^i ® I E ) ® |0)p<0| p . 

The motivation behind using our alternative formulation (0 is 
to prove later the convexity of the quantum conditional entropy 
(0 in terms of the parameters given in Eq. (0, so that we can 
use the convex optimization technique to find the minimum 
value of Eq. (0. 

In order to calculate the key rate, we need to consider Eve's 
ambiguity on Alice's classical bit Q, (6) defined as follows. 
Let 

P2,XEP = 2j L/)a(/'U ® lEpTr B [p2ABEp]\j)A{j\A ® hp- 

7=0,1 

Eve's ambiguity on Alice's classical bit S(X\EP) is defined as 

S (X\EP) = S ( P2 ,XEP) - S (p 2 ,Ep), (9) 

where P2,ep = Tr^ [p2,x£/>L and S(-) denotes the von Neumann 
entropy. 

In order to calculate the amount of public communication 
required for information reconciliation, we define the joint 
random variables (X', Y') as 

X' = j if the transmitted qubit is \<pj), 

Y' - k if the measurement outcome is F*, (10) 

under the condition that the measurement outcome is either 
Fq or F\. Observe the difference between X and X' . X' is not 
defined but X is defined to be when Bob's measurement 
outcome is either Fq or Fj. 

We shall show the asymptotic key rate per single transmitted 
qubit that is neither announced for the channel estimation nor 
discarded due to the measurement outcome being Fq or Fj. 
Note that Eq. (0 is Eve's ambiguity per a qubit that is not 
announced for the channel estimation but can be discarded. 



The probability of the measurement outcome being Fq or F\ 
is 

Tr[p lAB (I A ®(F + F l ))l 

So we can see that Eve's ambiguity per single transmitted 
qubit that is neither announced for the channel estimation nor 
discarded is 

S(X\EP) 
Tr[p ljAB (/®(F +F 1 ))]' 

By 0, the asymptotic key rate is 



S(X\EP) 



Tr[p MB (/®(F + Fi))] 



H(X'\Y'). 



(11) 



Note that the above formula assumes that Alice and Bob 
knows the channel between them. In the BB92 protocol, we 
cannot estimate all the parameters of the channel. We can 
only estimate part of them. In Eq. (fTTl i we can asymptotically 
determine the true values of Trfpi^B(7 ® (Fq + Fi))] and 
H(X'\Y'). On the other hand we cannot know the true value of 
S(X\EP). Therefore, we need to calculate the minimum value 
(i.e. the worst-case) of S(X\EP) over all the possible quantum 
channel £g between them. 

One can compute the minimum of S(X\EP) as follows. Ob- 
serve first that S (X\EP) is a function of the channel parameters 
Eq. (0 of &b- By the almost same argument as ||9] Remark 
11] one sees that S(X\EP) is a convex function of the channel 
parameters Eq. ©. Moreover, we see that the minimum of 
S(X\EP) is attained when R xy = R yx - R yz = R zy = t y = 
by the almost same argument as Proposition 1]. Therefore, 
one can compute the minimization of S (X\EP) by the convex 
optimization 0. 

III. Numerical Result 

We consider the depolarizing channel S g with depolarizing 
rate q. The definition of q follows |0. For a qubit density 
matrix p, we have & q {p) = (1 - q)p + (q/2)l2xi- With such a 
channel & q , R and t in Eq. (0 are given by 



R 



{ 1-4^/3 
1 






■4q/3 






■4q/3 ) 



t = 0. 



Define 



PlAB^^d^&qWKn 



Over G q with infinitely many qubits, the asymptotic key rate 
is given by 

min S(X\EP) 



Tr[p 1 , AB (/®(F + F 1 ))] 



- H(X'\Y'), 



(12) 



where the minimum is taken over the set of parameters in Eq. 
01 such that 

TrKIOXOI^Fo + UXl^FOp!^] 
= Tr[(|0><0|®F + |l><l|®Fi)p MB J, (13) 

Tr[(|l><l| ®F + 10X01 8F0P13B] 
= Tr[(|l><l|®F + 10X01 ®F 1 )p MBi9 ]. (14) 
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Fig. 1. Asymptotic Key Rate: The conventional methods |4|, |7|, |8| cannot 
generate key at depolarizing rate above 4.2% and they are not plotted. 

We also required that parameters in Eq. (|3) represent a 
completely positive map. We stress that we do not restrict 
the range of minimization to the depolarizing or the Pauli 
channels. The minimization is carried out over the set of all 
the qubit channels with ( TT~3T > and ( fT4l . 

The FindMinimum function in Mathematica 8.04 was used 
for the minimization. The program source code and the 
computation results are included in this eprint. 

We only considered a = 0.39 and did not optimized the 
value of a in Eq. (Q~|). The key rate is plotted in Fig. Q] The 
convex optimization did not converge in 10 5 iterations when 
the depolarizing rate < 4.5%. The key rate is plotted from 
depolarizing rate > 4.6%. 

IV. Conclusion 

In this paper, we reformulated the secure key rate formula 
of the B92 protocol as a convex optimization. We have not 
resorted to skillful manipulation of inequalities, and the secure 
key rate is computed simply by a numerical optimization 
procedure. The result shows that the B92 protocol can securely 
generate key at significantly higher depolarizing rates than 
previous security analyzes. 
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